[PATCH 10/13] DISA FSO copy editing of RHEL6/input/services/mail.xml

Shawn Wells shawn at redhat.com
Fri Nov 16 23:14:39 UTC 2012


On 11/16/12 5:55 PM, Shawn Wells wrote:
>
> 0010-DISA-FSO-copy-editing-of-RHEL6-input-services-mail.x.patch
>
>
>  From 74e9b069ac61e409cf7b1a16fc29bb26a11f5d72 Mon Sep 17 00:00:00 2001
> From: Shawn Wells<shawn at redhat.com>
> Date: Fri, 16 Nov 2012 07:31:56 -0500
> Subject: [PATCH 10/13] DISA FSO copy editing of RHEL6/input/services/mail.xml
>   DISA FSO copy editing of RHEL6/input/services/mail.xml
>
> ---
>   RHEL6/input/services/mail.xml |   48 ++++++++++++++++++++--------------------
>   1 files changed, 24 insertions(+), 24 deletions(-)
>
> diff --git a/RHEL6/input/services/mail.xml b/RHEL6/input/services/mail.xml
> index e54d610..4136da7 100644
> --- a/RHEL6/input/services/mail.xml
> +++ b/RHEL6/input/services/mail.xml
> @@ -71,16 +71,16 @@ e-mail configuration.</description>
>   <title>Disable Postfix Network Listening</title>
>   <description>
>   Edit the file <tt>/etc/postfix/main.cf</tt> to ensure that only the following
> -<tt>inet_interfaces</tt> line appears:
> +<tt>inet_interfaces</tt> line appears.
>   <pre>inet_interfaces = localhost</pre>
>   </description>
>   <ocil clause="it does not">
> -Run the following command to ensure postfix accepts mail messages from only the local system:
> +Run the following command to ensure postfix accepts mail messages from only the local system.
>   <pre>$ grep inet_interfaces /etc/postfix/main.cf</pre>
>   If properly configured, the output should show only <tt>localhost</tt>.
>   </ocil>
>   <rationale>
> -This ensures that <tt>postfix</tt> accepts mail messages
> +This ensures <tt>postfix</tt> accepts mail messages
>   (such as cron job reports) from the local system only,
>   and not from the network, which protects it from network attack.
>   </rationale>
> @@ -146,12 +146,12 @@ that access, while keeping other ports on the server in their default protected
>   
>   <Rule id="postfix_logging">
>   <title>Verify System Logging and Log Permissions for Mail</title>
> -<description>Edit the file <tt>/etc/rsyslog.conf</tt>. Add or correct the following line if necessary (this is the default):
> +<description>Edit the file <tt>/etc/rsyslog.conf</tt>. Add or correct the following line if necessary (this is the default).
>   <pre>mail.*					-/var/log/maillog</pre>
>   Run the following commands to ensure correct permissions on the mail log:
>   <pre># chown root:root /var/log/maillog
>   # chmod 600 /var/log/maillog</pre>
> -Ensure log will be rotated as appropriate by adding or correcting the following line if needed into the list on the first line of <tt>/etc/logrotate.d/syslog</tt> (this is the default):
> +Ensure log will be rotated as appropriate by adding or correcting the following line if needed into the list on the first line of <tt>/etc/logrotate.d/syslog</tt> (this is the default).
>   <pre>/var/log/maillog</pre>
>   </description>
>   <!-- <ident cce="TODO:CCE" /> -->
> @@ -170,16 +170,16 @@ an SSL certificate are independent of the MTA in use, and are described here.
>   <Group id="postfix_create_cert">
>   <title>Create an SSL Certificate</title>
>   <description>
> -Change into the CA certificate directory:
> +Change into the CA certificate directory.
>   <pre># cd /etc/pki/tls/certs</pre>
> -Generate a key pair for the mail server:
> +Generate a key pair for the mail server.
>   <pre># openssl genrsa -out mailserverkey.pem 2048</pre>
>   Next, generate a certificate signing request (CSR) for the CA to sign, making sure to supply your mail
> -server's fully qualified domain name as the Common Name:
> +server's fully qualified domain name as the Common Name.
>   <pre># openssl req -new -key mailserverkey.pem -out mailserver.csr</pre>
>   Next, the mail server CSR must be signed to create the mail server certificate. You can either send the CSR
>   to an established CA or sign it with your CA.
> -To sign mailserver.csr using your CA:
> +To sign mailserver.csr using your CA.
>   <pre># openssl ca -in mailserver.csr -out mailservercert.pem</pre>
>   </description>
>   <rationale>This step creates a private key, <tt>mailserverkey.pem</tt>, and a public certificate, <tt>mailservercert.pem</tt>.
> @@ -195,21 +195,21 @@ purpose.</warning>
>   
>   <Rule id="postfix_install_ssl_cert">
>   <title>Install the SSL Certificate</title>
> -<description>Create the PKI directory for mail certificates, if it does not already exist:
> +<description>Create the PKI directory for mail certificates, if it does not already exist.
>   <pre># mkdir /etc/pki/tls/mail
>   # chown root:root /etc/pki/tls/mail
>   # chmod 755 /etc/pki/tls/mail</pre>
>   Using removable media or some other secure transmission format, install the files generated in the previous
> -step onto the mail server:
> +step onto the mail server.
>   <pre>/etc/pki/tls/mail/serverkey.pem: the private key mailserverkey.pem
>   /etc/pki/tls/mail/servercert.pem: the certificate file mailservercert.pem</pre>
> -Verify the ownership and permissions of these files:
> +Verify the ownership and permissions of these files.
>   <pre># chown root:root /etc/pki/tls/mail/serverkey.pem
>   # chown root:root /etc/pki/tls/mail/servercert.pem
>   # chmod 600 /etc/pki/tls/mail/serverkey.pem
>   # chmod 644 /etc/pki/tls/mail/servercert.pem</pre>
>   Verify that the CA's public certificate file has been installed as <tt>/etc/pki/tls/CA/cacert.pem</tt>, and has the
> -correct permissions:
> +correct permissions.
>   <pre># chown root:root /etc/pki/tls/CA/cacert.pem
>   # chmod 644 /etc/pki/tls/CA/cacert.pem</pre>
>   </description>
> @@ -229,7 +229,7 @@ correct permissions:
>   
>   <Rule id="postfix_server_denial_of_service">
>   <title>Limit Denial of Service Attacks</title>
> -<description>Edit <tt>/etc/postfix/main.cf</tt>. Add or correct the following lines:
> +<description>Edit <tt>/etc/postfix/main.cf</tt>. Add or correct the following lines.
>   <pre>default_process_limit = 100
>   smtpd_client_connection_count_limit = 10
>   smtpd_client_connection_rate_limit = 30
> @@ -259,7 +259,7 @@ typical at your site, look in <tt>/var/log/maillog</tt> for lines with the daemo
>   <Rule id="postfix_server_banner" severity="medium">
>   <title>Configure SMTP Greeting Banner</title>
>   <description>Edit <tt>/etc/postfix/main.cf</tt>, and add or correct the following line, substituting some other wording for the
> -banner information if you prefer:
> +banner information if you prefer.
>   <pre>smtpd_banner = $myhostname ESMTP</pre>
>   </description>
>   <rationale>The default greeting banner discloses that the listening mail process is Postfix.
> @@ -286,15 +286,15 @@ with SSL support.
>   
>   <Rule id="postfix_server_mail_relay_set_trusted_networks">
>   <title>Configure Trusted Networks and Hosts</title>
> -<description>Edit <tt>/etc/postfix/main.cf</tt>, and configure the contents of the mynetworks variable in one of the following
> -ways:
> +<description>Edit <tt>/etc/postfix/main.cf</tt>, and configure the contents of the <tt>mynetworks</tt> variable in one of the following
> +ways.
>   <ul>
> -<li>If any machine in the subnet containing the MTA may be trusted to relay messages, add or correct the line:
> +<li>If any machine in the subnet containing the MTA may be trusted to relay messages, add or correct the following line.
>   <pre>mynetworks_style = subnet</pre></li>
> -<li>If only the MTA host itself is trusted to relay messages, add or correct:
> +<li>If only the MTA host itself is trusted to relay messages, add or correct the following line.
>   <pre>mynetworks_style = host</pre></li>
>   <li>If the set of machines which can relay is more complicated, manually specify an entry for each netblock
> -or IP address which is trusted to relay by setting the mynetworks variable directly:
> +or IP address which is trusted to relay by setting the <tt>mynetworks</tt> variable directly.
>   <pre>mynetworks = 10.0.0.0/16 , 192.168.1.0/24 , 127.0.0.1</pre></li>
>   </ul>
>   </description>
> @@ -312,7 +312,7 @@ mail.
>   <Rule id="postfix_server_mail_relay_for_trusted_networks">
>   <title>Allow Unlimited Relaying for Trusted Networks Only</title>
>   <description>Edit <tt>/etc/postfix/main.cf</tt>, and add or correct the <tt>smtpd_recipient_restrictions</tt> definition so that it
> -contains at least:
> +contains at least.
>   <pre>smtpd_recipient_restrictions =
>       ...
>       permit_mynetworks,
> @@ -338,7 +338,7 @@ This section describes how to configure authentication using the Cyrus-SASL impl
>   discussion of other options.
>   <br /><br />
>   To enable the use of SASL authentication, edit <tt>/etc/postfix/main.cf</tt> and add or correct the following
> -settings:
> +settings.
>   <pre>smtpd_sasl_auth_enable = yes
>   smtpd_recipient_restrictions =
>       ...
> @@ -347,7 +347,7 @@ smtpd_recipient_restrictions =
>       reject_unauth_destination,
>       ...</pre>
>   Then edit <tt>/usr/lib/sasl2/smtpd.conf</tt> and add or correct the following line with the correct authentication
> -mechanism for SASL to use:
> +mechanism for SASL to use.
>   <pre>pwcheck_method: saslauthd</pre>
>   <service-enable-macro service="saslauthd" />
>   </description>
> @@ -373,7 +373,7 @@ work via PAM, look at the <tt>saslauthd(8)</tt> manpage to find out how to confi
>   
>   <Rule id="postfix_server_mail_relay_require_tls_for_smtp_auth">
>   <title>Require TLS for SMTP AUTH</title>
> -<description>Edit <tt>/etc/postfix/main.cf</tt>, and add or correct the following lines:
> +<description>Edit <tt>/etc/postfix/main.cf</tt>, and add or correct the following lines.
>   <pre>smtpd_tls_CApath = /etc/pki/tls/CA
>   smtpd_tls_CAfile = /etc/pki/tls/CA/cacert.pem
>   smtpd_tls_cert_file = /etc/pki/tls/mail/servercert.pem
> -- 1.7.1


Ack

(note these patches were created by FSO, not myself. I only posted 
publicly.)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20121116/1fa443a3/attachment-0001.html>


More information about the scap-security-guide mailing list